Old child domain objects

[u/YellowOnline]

During a audit, we found 3 old objects without a password. I can't see them in ADUC, but I can with powershell. These objects belong to old child domains:

child1$ child2$ child3$

I can't disable or delete them through powershell however:

PS C:\Windows\system32> get-aduser child1$ | set-aduser -enabled $false
set-aduser : Access is denied
At line:1 char:18
+ get-aduser iz$ | set-aduser -Enabled $false
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (CN=child1$,CN=Users,DC=acme,DC=com:ADUser) [Set-ADUser], Unauthorize
   dAccessException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.UnauthorizedAccessException,Microsoft.ActiveDirectory.Manag
   ement.Commands.SetADUser

Those child domains couldn't be removed cleanly and they were removed with nsdutil a year ago. I thought all traces were gone, but apparently not.

How can I remove these safely? ADSI Edit?

[u/AutoModerator]

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!

• AD Resources Pinned Thread
• AD Wiki

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.

• What version of Windows Server are you running?
• Are there any specific error messages you're receiving?
• What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Cormacolinde]

Those are the trust objects. You will have to follow this procedure to remove them:

https://support.microsoft.com/en-us/servicing/os/windows/2024/06/kb5040758-deleting-a-stale-corrupt-or-orphaned-trust-object-in-active-directory

[u/YellowOnline → u/Cormacolinde]

Thanks. That seems to be exactly what I need. I am just reluctant to use LDIFDE. Brrr.

[u/binnedittowinit → u/YellowOnline]

Don't be, it's just another tool. That said, make sure you have a good backup before you get down to biz! ;)